Ohxorud-Dev

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** A privilege escalation issue exists in the API endpoint `POST /users/{username}/tokens` used for creating Personal Access Tokens. The endpoint is protected by the `reqBasicOrRevProxyAuth` middleware, which is designed to require password-based authentication to prevent a compromised token from being used to generate new ones. However, if a token is provided in the `Authorization: Basic <token>:x-oauth-basic` format, the system incorrectly sets the `AuthedMethod` to `basic` and `IsBasicAuth` to `true`, bypassing the middleware guard. Once the guard is bypassed, the `CreateAccessToken` function fails to enforce a scope ceiling, meaning it does not verify if the requested scopes are a subset of the caller's current scopes. Consequently, an attacker possessing a restricted token (such as one with only `write:user` permissions) can create a new token with the `all` scope, granting full administrative access to the account without knowing the user's password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.27.0 **Description** Gitea allows a token with `public-only,write:repository` restrictions to update a private pull request head branch. This occurs because the system validates the token's public-only restriction against the public base repository route but fails to re-apply this restriction to the private head repository during the update process. Consequently, an attacker with such a token can cause Gitea to push commits from a public base repository into a private head branch, bypassing the intended access limitations. Technical details include: - **API Endpoint:** `POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update` - **Vulnerable Function:** `UpdatePullRequest()` If Gitea Actions is enabled on the private head repository, this unauthorized push can also trigger the execution of private repository `push` workflows. **Recommendations** Update Gitea to version 1.27.0.

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.26.1 **Description** In the Git Smart HTTP path, the system fails to enforce repository-scoped access-token permissions when tokens are provided via Bearer authentication. While the `CheckRepoScopedToken()` function is designed to validate scopes, it returns early if the request is not using HTTP Basic authentication. Consequently, a Personal Access Token (PAT) or OAuth2 token sent as `Authorization: Bearer <token>` bypasses scope checks entirely. This allows a token with limited permissions (for example, only `read:notification`) to perform operations such as cloning or fetching private repositories without the `read:repository` scope, or pushing to repositories without the `write:repository` scope, provided the token owner has the necessary repository RBAC permissions. The issue affects the `CheckRepoScopedToken()` function and impacts Git Smart HTTP routes. **Recommendations** Update Gitea to version 1.26.1 or later.